github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: do not enable node integration in child window if not enabled (#15190)

Browse Source
This commit is contained in:
Cheng Zhao
2018-10-16 19:25:40 +09:00
committed by GitHub
parent 6281e4ef0b
commit 0c09199f77
4 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
atom/browser/web_contents_preferences.cc
View File

@@ -397,6 +397,8 @@ void WebContentsPreferences::OverrideWebkitPrefs(
std::string encoding;
if (GetAsString(&preference_, "defaultEncoding", &encoding))
prefs->default_encoding = encoding;
prefs->node_integration = IsEnabled(options::kNodeIntegration);
}
} // namespace atom

10
atom/renderer/atom_renderer_client.cc
View File

@@ -16,6 +16,7 @@
#include "atom/renderer/atom_render_frame_observer.h"
#include "atom/renderer/web_worker_observer.h"
#include "base/command_line.h"
#include "content/public/common/web_preferences.h"
#include "content/public/renderer/render_frame.h"
#include "native_mate/dictionary.h"
#include "third_party/blink/public/web/web_document.h"
@@ -86,6 +87,15 @@ void AtomRendererClient::DidCreateScriptContext(
if (!render_frame->IsMainFrame() && !IsDevToolsExtension(render_frame))
return;
// Don't allow node integration if this is a child window and it does not have
// node integration enabled. Otherwise we would have memory leak in the child
// window since we don't clean up node environments.
//
// TODO(zcbenz): We shouldn't allow node integration even for the top frame.
if (!render_frame->GetWebkitPreferences().node_integration &&
render_frame->GetWebFrame()->Opener())
return;
injected_frames_.insert(render_frame);
// Prepare the node bindings.

9
patches/common/chromium/.patches.yaml
View File

@@ -491,3 +491,12 @@ patches:
dylib currently fails to resolve Squirrel.framework on OSX, we need to fix
this but it is not a blocker for releasing Electron. This patch removes
the hard fail on dylib resolve failure from dump_syms
-
author: zcbenz <zcbenz@gmail.com>
file: web_preferences.patch
description: |
Add a node_integration field to WebPreferences so we can determine whether
a frame has node integration in renderer process.
This is required by the nativeWindowOpen option, which put multiple main
frames in one renderer process.

26
patches/common/chromium/web_preferences.patch Normal file
View File

@@ -0,0 +1,26 @@
diff --git a/content/public/common/common_param_traits_macros.h b/content/public/common/common_param_traits_macros.h
index 57f03dc..7c4409e 100644
--- a/content/public/common/common_param_traits_macros.h
+++ b/content/public/common/common_param_traits_macros.h
@@ -198,6 +198,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::WebPreferences)
IPC_STRUCT_TRAITS_MEMBER(animation_policy)
IPC_STRUCT_TRAITS_MEMBER(user_gesture_required_for_presentation)
IPC_STRUCT_TRAITS_MEMBER(text_track_margin_percentage)
+ IPC_STRUCT_TRAITS_MEMBER(node_integration)
IPC_STRUCT_TRAITS_MEMBER(save_previous_document_resources)
IPC_STRUCT_TRAITS_MEMBER(text_autosizing_enabled)
IPC_STRUCT_TRAITS_MEMBER(double_tap_to_zoom_enabled)
diff --git a/content/public/common/web_preferences.h b/content/public/common/web_preferences.h
index 78cbf5f..b33ac28 100644
--- a/content/public/common/web_preferences.h
+++ b/content/public/common/web_preferences.h
@@ -222,6 +222,9 @@ struct CONTENT_EXPORT WebPreferences {
// Cues will not be placed in this margin area.
float text_track_margin_percentage;
+ // Electron: Whether the frame has node integration.
+ bool node_integration = false;
+
bool immersive_mode_enabled;
bool text_autosizing_enabled;